Symbian代码签名证书申请和使用指南

本指南由 WoSign 根据VeriSign网站和Symbian网站有关内容整理翻译，请同时参考：移动代码签名证书(ACS)常见问题、 A guide to Symbian Signed 。如果您要申请 Symbian Signed 认证，请同时参考：Symbian Signed认证常见问题问答。

VeriSign Authenticated Content Signing (ACS) for Symbian(Symbian 代码签名证书)使得软件开发商能安全地开发基于Symbian操作系统的应用软件，并安全地运行在Symbian操作系统的移动终端上。VeriSign ACS让您能数字签名您的应用软件，并安全地、Web方式实时签名您的文件和管理您的签名帐户，严格的软件开发商身份验证保护了软件开发商的合法权益。

第1步 在线申请 Step 1 - Enroll for your ACS Publisher ID

WoSign 会给用户一个申请网址让用户自己在线填写有关申请信息，提交申请成功后，请告诉 WoSign 定单号即可。申请过程中请注意以下几点： 
(1) 公司名称只能填写英文名称，如果申请单位只能提交中文名称的营业执照，则英文名称只能是通用英文单词的直译。公司商号只能是拼音。VeriSign认可 WoSign 审核过的中文名称营业执照作为证明文件； 
(2) 填写单位联系人(Organization Contact)时必须填写提交的电话费单上能联系到的联系人； 
(3) 在证书申请过程中需要用户填写管理密码(Challenge Phrase)，请一定牢记此密码，查询证书申请状态、修改联系人信息和取回证书都要用到此密码；
(4) 电子邮件只能用企业邮局，不得用公用邮箱(如：Hotmail、Gmail等等)；
(5) 申请到最后的付款(Payment)阶段，请选择“Token”(代用币)付款方式，输入WoSign告诉用户的Token Number即可。如下图1所示：

(6) 紧接者就是填写填写付款联系人(Billing Contact Information)时，请填写： First Name: Billing, Last Name: WoSign, Title: Manager, Company: WoSign, Inc., Address1: Fangda Building, Suite 1803, Hi-Tech Industrial Park, City: Shenzhen, State/Province: Guangdong, Zip/Postal Code: 518057, Country: 选 China,Telephone: +86-755-61313000, Email: 

On the ACS for Symbian page, select the starter pack (ACS Publisher ID without Smartcard) and click Buy Now.

1. Complete and submit the enrollment form. You will receive an automated e-mail acknowledgement - you don't need to do anything with this. VeriSign Customer Support will process your order. If necessary, VeriSign may contact you to confirm your order information and/or for additional documentation such as Proof of Right (POR) documents. Note that the Organization Contact listed on your enrolment will be contacted by telephone for verifying your details. Please alert this person in order to expedite your certificate processing.

第2步 取回您的Symbian代码签名证书 Step 2 - Pick up your ACS Publisher ID

您提交申请后，WoSign会把您的证明文件翻译整理后提交给VeriSign，VeriSign会电话联系您填写的单位联系人进行定单确认， 一旦完成验证则会发一个Email给用户，如下图2所示：

用户只要点击邮件中的链接到VeriSign网站上取回证书即可，如下图3所示，需要输入邮件中的PIN码和在证书申请过程中填写的管理密码(Challenge Phrase)，再点击“Continue”即可完成证书安装：

1. Once your order is approved, you will receive an approval e-mail with instructions on how to pick up your ACS Publisher ID. 
   Important: Save this e-mail for future reference.
2. Go to the VeriSign Web site provided in your approval e-mail to pick up and install your Publisher ID.

第3步 导出证书和转换证书格式 Step 3 - Download and use Symbian Key Export Utility

(1) 请打开IE浏览器，在“工具” — “ Internet 选项”中选“内容”，再点击“证书”就可以看到您的签名证书，此签名证书将用于登录Symbian签名管理系统(ACS Signing Account Manager)的身份认证，同时也用于签名Symbian SIS文件。但是，Symbian的签名工具需要双证书文件(.pvk和.cer)来签名SIS文件，所以用户需要把已经安装到IE中的证书导出为.PFX格式；

(2) 下载 证书格式转换工具，把导出的.pfx格式证书和转换工具放在同一目录下，在DOS状态下输入以下命令转换证书文件：

vs_pkcs -p12 pfxFile -passwd pfxPassword -key mykey.key -cer mycert.cer

其中：pfxfile就是导出的.pfx文件名，pfxPassword就是导出.pfx格式证书时设置的密码，mykey.key就是转换后的私钥文件，mycert.cer就是转换后的证书公钥文件。

1. The private key and certificate embedded on your IE browser key store need to be converted into a format that the Symbian MakeSIS tool can use. The Symbian Key Export Utility available here will enable this conversion.
2. Please read and accept the click through software license.
3. Download and run Symbian Key Export Utility to do this conversion. 
   
   Follow instructions below to do the key export :

1. Once you have downloaded the 'Symbian Key Export Tool'(vs_pkcs.zip), extract the contents and copy the vs_pkcs.exe executable and ReadMe.txt files to any folder.
1. From your IE browser, select your ACS publisherID cert. Tools -> Internet Options -> Content -> Certificates .
2. With the cert selected, click on 'Export' and follow the steps in the Certificate Export Wizard. Make sure you choose 'Yes, export the private key' option when asked 'Do you want to export the private key with the certificate?'
3. You can choose to enter a password to protect the private key or you can leave it blank.
4. Once you have exported successfully to a .pfx file, copy the file to the folder containing the downloaded vs_pkcs.exe executable and follow the instructions in the ReadMe.txt to create a .key and .cer file for use with the Symbian MakeSIS tool.

第4步 签名SIS文件，并把签名后的SIS文件提交给VeriSign重签名或提交给Symbian测试 Step 4 - Sign your SIS files and send to Symbian testing lab

(1) 使用Symbian MakeSIS tool来签名SIS文件，需要用户导入签名证书文件：mykey.key 和 mycert.cer；

(2) 把已经签名的SIS文件发给Symbian testing lab，通过 Symbian 测试后Symbian会重签名后就可以让最终用户安全安装和下载了。

1. Use Symbian MakeSIS tool to sign your SIS files with your ACS Publisher ID. Make sure you sign the version of your application that you are sending to the Symbian testing lab. Note that if you make any changes to the signed file, it will be break the signature and you will need to sign it again with the ACS Publisher ID.
2. Follow Symbian instructions to send your signed SIS files to the Symbian testing lab.
3. Symbian testing lab will verify your signature and test them per Symbian testing and certification procedures. (Please contact Symbian directly for any questions on the testing or certification procedures).
4. Once the application passes the test requirements, Symbian testing lab will access the VeriSign Signing Account Manager portal and will re-sign your application using a single use ACS Content IDs that chains up to the Symbian Testing Based Root CA - the trust point embedded in Symbian-based devices.
5. The application is now certified and will be sent back to you by the Symbian testing lab. 
   
   Important:
   • You can access the ACS Signing Account Manager only if you have a valid ACS Publisher ID. However, at this time, you will not be able to access the Symbian Testing Based Root signing service since this is restricted per Symbian requirements to the Symbian testing partner. You will get a message that tells you that you are not presently authorized to sign applications for this platform.
   • Steps 1 -2 are one-time only until renewal after 1 year.